Press releases

Third Party Browser Extensions for Instagram, Facebook, Vimeo and Others Infected with Malware

Around 3 million people affected worldwide, Avast threat intelligence experts recommend to disable or uninstall extensions for now

Around 3 million people affected worldwide, Avast threat intelligence experts recommend to disable or uninstall extensions for now


Prague, Czech Republic, December 16th, 2020 — Threat Intelligence researchers from Avast (LSE:AVST), a global leader in digital security and privacy products, have identified malware hidden in at least 28 third party Google Chrome and Microsoft Edge extensions associated with some of the world’s most popular platforms. The malware has the functionality to redirect user’s traffic to ads or phishing sites and to steal people’s personal data, such as birth dates, email addresses, and active devices. According to the app stores’ download numbers, around three million people may be affected worldwide.

The extensions which aid users in downloading videos from these platforms include Video Downloader for Facebook, Vimeo Video Downloader, Instagram Story Downloader, VK Unblock, and other browser extensions on the Google Chrome Browser, and some on Microsoft Edge Browser. The researchers have identified malicious code in the Javascript-based extensions that allows the extensions to download further malware onto a user’s PC. 

Users have also reported that these extensions are manipulating their internet experience and redirecting them to other websites. Anytime a user clicks on a link, the extensions send information about the click to the attacker’s control server, which can optionally send a command to redirect the victim from the real link target to a new hijacked URL before later redirecting them to the actual website they wanted to visit. User’s privacy is compromised by this procedure since a log of all clicks is being sent to these third party intermediary websites. The actors also exfiltrate and collect the user’s birth dates, email addresses, and device information, including first sign in time, last login time, name of the device, operating system, used browser and its version, even IP addresses (which could be used to find the approximate geographical location history of the user).

Avast researchers believe the objective behind this is to monetize the traffic itself. For every redirection to a third party domain, the cybercriminals would receive a payment. Nonetheless, the extension also has the capability to redirect the users to ads or phishing sites. 

“Our hypothesis is that either the extensions were deliberately created with the malware built in, or the author waited for the extensions to become popular, and then pushed an update containing the malware. It could also be that the author sold the original extensions to someone else after creating them, and then the buyer introduced the malware afterwards,” said Jan Rubín, Malware Researcher at Avast.

The Avast Threat Intelligence team started monitoring this threat in November 2020, but believe that it could have been active for years without anyone noticing. There are reviews on the Chrome Web Store mentioning link hijacking from as far back as December 2018. Rubín added, “The extensions’ backdoors are well-hidden and the extensions only start to exhibit malicious behavior days after installation, which made it hard for any security software to discover.”

The malware has been quite difficult to detect since it has the ability to "hide itself". Avast malware researcher, Jan Vojtěšek, said "the virus detects if the user is googling one of its domains or, for instance, if the user is a web developer and, if so, won't perform any malicious activities on their browsers. It avoids infecting people more skilled in web development, since they could more easily find out what the extensions are doing in the background."

At this moment, the infected extensions are still available for download. Avast has contacted the Microsoft and Google Chrome teams to report them. Both Microsoft and Google confirmed they are currently looking into the issue. In the meantime, Avast recommends users disable or uninstall the extensions for now until the problem is resolved and then scan for and remove the malware.

The list of detected extensions affected is below:

Direct Message for Instagram

Direct Message for Instagram™

DM for Instagram

Invisible mode for Instagram Direct Message

Downloader for Instagram

Instagram Download Video & Image

App Phone for Instagram

App Phone for Instagram

Stories for Instagram

Universal Video Downloader

Universal Video Downloader

Video Downloader for FaceBook™

Video Downloader for FaceBook™

Vimeo™ Video Downloader

Vimeo™ Video Downloader

Volume Controller

Zoomer for Instagram and FaceBook

VK UnBlock. Works fast.

Odnoklassniki UnBlock. Works quickly.

Upload photo to Instagram™

Spotify Music Downloader

Stories for Instagram

Upload photo to Instagram™

Pretty Kitty, The Cat Pet

Video Downloader for YouTube

SoundCloud Music Downloader

The New York Times News

Instagram App with Direct Message DM